I currently have a baffling problem in my W2K8 Native mode Domain. The symptom is that I have many machines that get hung on "Applying Software Installation..." to the point where we have to tell users to unplug their network cable before logon in order for the machines to skip by that part.
The core of the problem is that both the GPO and installation share point to a failed DC that was removed from the network forcefully over a year and a half ago. I enlisted the help of Microsoft to seize the FSMO Roles and clean all traces of Metadata from the remaining DC's. I again have a paid support case with Microsoft open, but 3 days into this we do not have a resolution.
Below are my troubleshooting steps:
1) Extensive LDAP Queries do not locate references to the missing GPO or DC
2) Replication works perfectly between all 3 DCs
3) All real GPOs apply perfectly top the machines and users.
4) I created a Test OU with no policies, put a machine and user in there and it will erase the failed GPOs from the workstation. Returning it to the original OU works, the 'real' policies reapply, and the machine will be in a clean state.
I have asked Microsoft if they have a utility that will purge / clean / reset any and all traces of ALL GPO history from workstations. They said 'No' which I find is an amazingly terrible answer. Extensive Googling has let me to write a simple batch file that deletes these files and registry entries:
DEL /S /F /Q "%ALLUSERSPROFILE%\Application Data\Microsoft\Group Policy\History\*.*"
REG DELETE HKEY_LOCAL_MACHINE\Software\Policies\Microsoft /va /f
REG DELETE HKEY_CURRENT_USER\Software\Policies\Microsoft /va /f
REG DELETE "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects" /va /f
REG DELETE HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies /va /f
If I run this on a sample workstation, it will delete the items, but on reboot and several gpupdate /force's later, I still get this when I run a gpresult:
Resultant Set Of Policies for Computer
Name: Adobe Reader XI (11.0.07)
Deployment State: Assigned
Origin: Applied Application
Even searching the registry on the machine for " \\Company\netlogon\AcroRead
" yeilds zero results.
My question for anyone out there:
For Windows 7 x64 and Windows 8.1, is there any absolute way to remove any and all traces of GPO history? It is not possible for to move 250 workstations in 13 locations into a clean OU just for the purpose of cleaning GPOs. To do so would cripple my user's ability to work.
Thanks in advance